Discover tab won't load anymore

Elastic Stack Elasticsearch
21

I was running Elasticsearch and Kibana in a Ubuntu based docker container and I was able to reproduce similar case. I used elasticdump to export and import the data /1/. The imported dashboard was for two indices called topbeat-* and statsd-*. The importing works if the indices are already created when the import is done. If the import is made after the .kibana is yellow/green and it is the only index, the importing /1/ seem to break the discover tab in Kibana so that it does not load anymore. I did not see any relevant logs with default settings in the KIbana4 logs with the exception of timeouts /2/

The behavior is similar if manual import is made if for example only one of the indices is there. In that case the import is not done for the visualizations that are for the index that is not there.

The use case is to deploy a container with predefined setting for analytics. The Kibana version was 4.5.0 and Elasticsearch 2.3.2. Browser was latest Chrome.

/1/
npm install elasticdump
elasticdump --input=http://localhost:9200/.kibana --output=$ --type=data --searchBody='{"filter": { "or": [ {"type": {"value": "dashboard"}}, {"type" : {"value":"visualization"}}] }}' > kibana-exported.json
elasticdump --input=/kibana-exported.json --output=http://localhost:9200/.kibana --type=data

/2/
{"type":"response","@timestamp":"2016-05-27T10:55:31+00:00","tags":[],"pid":235,"method":"post","statusCode":201,"req":{"url":"/elasticsearch/.kibana/index-pattern/topbeat-?op_type=create","method":"post","headers":{"host":"app-kibana.env","content-length":"50","accept":"application/json, text/plain, /","origin":"https://app-kibana.env","kbn-version":"4.5.0","user-agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36","content-type":"application/json;charset=UTF-8","referer":"https://app-kibana.env/app/kibana","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.8"},"remoteAddress":"x.x.x.x","userAgent":"x.x.x.x","referer":"https://app-kibana.env/app/kibana"},"res":{"statusCode":201,"responseTime":54,"contentLength":9},"message":"POST /elasticsearch/.kibana/index-pattern/topbeat-?op_type=create 201 54ms - 9.0B"}

22

For me the solution to get the dashboard import to work was to give command /1/ after importing the dashboard with elasticdump. The full dump of .kibana index with elasticdump did not do the trick and the command /1/ was still needed. The problem was reproduced just in a Docker container. I did not fully understand the case so it is likely that I missed something.

/1/ https://github.com/elastic/kibana/issues/2310
curl -XPUT 'http://localhost:9200/.kibana/search/guid' -d '{"title":"guid","description":"Search panel for guid Logs","hits":0,"columns":["type","messageType","application","logMessage","module"],"kibanaSavedObjectMeta":{"searchSourceJSON":"{"query":{"query_string":{"query":""}},"filter":[],"index":"_guid-logstash-"}"}}'

23

Is the issue resolved.... As I am also facing similar kind of issue

24

Issue is fixed by following, Conversations above were helpful in understanding the problem.

Issue is reproducible with use case where kibana with dashboards and visualisations on start up are required and dashboard, visualisation jsons are posted via elasticsearch.

Explanation:
Before posting the dashboard jsons to elastic search,configure the dashboard field types for hits and version fields,
If it is not done then elasticsearch assumes type for those fields as long. and while switching from dashboard to discover it tries to map the field types of the dashboard mapping, there is a mismatch as kibana expects it to be a integer. Following error is received, and discover tab doesn't load
Error: [illegal_argument_exception] Mapper for [hits] conflicts with existing mapping in other types:
[mapper [hits] cannot be changed from type [long] to [int]]

In order to solve this , delete the .kibana index from elastic search and use following curl commands
curl -XDELETE http://ip:port/.kibana

curl -XPUT http://ip:port/.kibana/_mapping/dashboard -d '{"dashboard":{"properties":{"title":{"type":"string"},"hits":{"type":"integer"},"description":{"type":"string"},
"panelsJSON":{"type":"string","optionsJSON":{"type":"string"},"uiStateJSON":{"type":"string"},"version":{"type":"integer"}
"timeRestore":{"type":"boolean"},"timeTo":{"type":"string"},"timeFrom":{"type":"string"},"kibanaSavedObjectMeta":{"properties":{"searchSourceJSON":{"type":"string"}}}}}
}'
then post the dashboard and visualisations jsons to elasticsearch.

Inorder to avoid this issue just, post the PUT request before posting the dashboard and visualisations jsons to elasticsearch.

This issue will not be seen if dashboards are created directly via kibana UI not through elasticsearch.

25

In improvement to @Rohit_Singh 's answer we don't need to add the dashboard mapping i was able to do the same with following approach:-
For each dashboard the general curl commands are of the format with dashboard json as of
`curl -XPUT 'localhost:9200/.kibana/dashboard/mydashboard?pretty' -d '
{
"title" : "",
"hits" : 0,
"description" : "",
"panelsJSON" : ,
"optionsJSON" : ,
"uiStateJSON" : ,
"version" : 1,
"timeRestore" : false,
"kibanaSavedObjectMeta" : {
"searchSourceJSON" : }"

}'`
which should be modified as
curl -XPUT 'localhost:9200/.kibana/dashboard/mydashboard?pretty' -d '
{
"title" : "",
"panelsJSON" : ,
"optionsJSON" : ,
"uiStateJSON" : ,
"timeRestore" : false,
"kibanaSavedObjectMeta" : {
"searchSourceJSON" : }"

}'
and same for visualizations -
curl -XPUT 'localhost:9200/.kibana/visualization/myvisualization?pretty' -d '
{
"title" : ,
"visState" : ,
"uiStateJSON" : ,
"description" : "",
"version" : 1,
"kibanaSavedObjectMeta" : {
"searchSourceJSON" :
}
}'
should be modified as
curl -XPUT 'localhost:9200/.kibana/visualization/myvisualization?pretty' -d '
{
"title" : ,
"visState" : ,
"uiStateJSON" : ,
"kibanaSavedObjectMeta" : {
"searchSourceJSON" :
}
}'
I have tested this modification on my elk installation and it works fine without adding any mapping in the kibana index

26